The security configuration for the Db2 Data Gate synchronization function fails

Diagnosing the problem

The most likely reasons are listed here. Check each one of them to see if it applies:

• The inbound network connection to z/OS is not configured correctly. For example, the host name, the port, or the IP address of the Db2 Data Gate instance might be wrong. For more information about the configuration of inbound network connections, see Configuring inbound access to Db2 for z/OS for Db2 Data Gate.

  Also make sure that you run the command F PAGENT,REFRESH to let changes to the configuration of the policy agent take effect.

• The outbound network connection from z/OS is not configured correctly. The PKCS12 certificate might be invalid, or the user might have insufficient privileges. For more information about the configuration of outbound network connections, see Encrypting outbound network traffic from Db2 for z/OS to Db2 Data Gate
  The PKCS12 certificate is used by the Stunnel service on Cloud Pak for Data. Verify that the Stunnel service is working by running following command on the machine where Cloud Pak for Data is installed:

  openssl s_client -connect <hostname>:<port> -msg

  where

  <hostname>

  Is the host name you specified during the creation (provisioning) of the Db2 Data Gate instance.

  <port>

  Is the port number you specified during the creation (provisioning) of the Db2 Data Gate instance.

  The expected output of this command is:

  TLS 1.2 Handshake [length 00c3], ClientHello
  ... ...
  <<< TLS 1.2 Handshake [length 003d], ServerHello
  ... ...
  <<< TLS 1.2 Handshake [length 0631], Certificate
  ... ...
  <<< TLS 1.2 Handshake [length 014d], ServerKeyExchange
  ... ...
  <<< TLS 1.2 Handshake [length 0004], ServerHelloDone
  ... ...
  TLS 1.2 Handshake [length 0046], ClientKeyExchange
  ... ...
  TLS 1.2 ChangeCipherSpec [length 0001]
  01
  TLS 1.2 Handshake [length 0010], Finished
  ... ...

• The route is not configured correctly. To check this:
  1. Log in to the infrastructure node of Cloud Pak for Data.
  2. List the existing routes by running the following command:

     oc get route

  3. Make sure there is only one record for a particular Db2 Data Gate instance. For example:

     NAME HOST/PORT PATH SERVICES PORT TERMINATION 
     dg1591202855434 dg.demo.os.ibm.com 
     dg-1591202855434-data-gate-server-svc 11400 passthrough

  The NAME contains the ID (that is, 1591202855434 in the above example) of the Db2 Data Gate instance. This ID is also shown in the URL on the web user interface when you open the Db2 Data Gate instance, for example:

  https://xxxxx/data-gate/#/details/1591202855434

• The iptable firewall of Cloud Pak for Data is not configured correctly. If the port of the Db2 Data Gate instance is 443 (the default value), you need not redirect connections over this port.
  However, if the port of the Db2 Data Gate instance is not 443 (for example, the port might be 44443), check the iptable settings:

  1. Log in to the infrastructure node of Cloud Pak for Data.
  2. Display the settings of iptables by running the following command:

     iptables -t nat -L

  3. Make sure the port (for example 44443) is redirected to port 443. The expected output looks like this:

     Chain PREROUTING (policy ACCEPT)
     target prot opt source destination
     REDIRECT tcp -- anywhere anywhere tcp dpt:44443 redir ports 443
     Chain INPUT (policy ACCEPT)
     target prot opt source destination
     Chain OUTPUT (policy ACCEPT)
     target prot opt source destination
     Chain POSTROUTING (policy ACCEPT)
     target prot opt source destination

• The setting for IP forwarding is incorrect. If the port of the Db2 Data Gate instance is 443 (the default value), you need not configure IP forwarding (net.ipv4.ip_forward)
  However, if the port of the Db2 Data Gate instance is not 443 (for example, the port might be 44443), check if net.ipv4.ip_forward is set to 1 in the /etc/sysctl.conf file. To this end, display the net.ipv4.ip_forward setting in sysctl.conf by running the following command:

  cat /etc/sysctl.conf | grep net.ipv4.ip_forward

  A value of 1 means that IP forwarding is enabled. A value of 0 means IP forwarding is disabled.

  Make sure that net.ipv4.ip_forward = 1 is set.